[clang][analyzer] False positive: non-inlined recursive call invalidates an unchanged pointer
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
**Description:**
A proven non-null var constraint is lost across a call to a static recursive function.
**Reproducer:**
```c
void clang_analyzer_eval(int);
void clang_analyzer_explain(void *);
static void a(int **p, unsigned n)
{
if (n)
a(p, n-1);
}
int entry(unsigned n)
{
int x = 0;
int *p = &x;
a(&p, n);
clang_analyzer_eval(p != 0); // TRUE and FALSE, expected only TRUE
clang_analyzer_explain(p); // symbol of type 'int *' conjured at CFG element
return *(p ? p : 0); // core.NullDereference
}
```
Contributor guide
Research direction
Start by reproducing the reported result with the clang static analyzer using the C snippet in the issue, then trace how the non-inlined static recursive call handles the unchanged pointer constraint. Done means the analyzer reports only TRUE for p != 0 and does not report core.NullDereference for the final dereference.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100